remcos | 4ae1035134ff758e3061a4e823d31d238ce80d6f41128710523617ca54727097

Analysis

max time kernel
149s
max time network
140s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

PO 001, 002, 003,.exe
Size

1.1MB
MD5

a2ed6ebe9a320464660946cd8b712a4c
SHA1

b82fd7fc19665c17bef8f198b35cc867b990b322
SHA256

aecb74252f3ae4e3d912c1983de70c06ac29c69b287b31e45d29fbee0ccb5772
SHA512

5908b07ac8a3f26f53ce4d78e795cdf1e2e71ccab4e7c20b3f1c5e01c95d41221728166de645185933ff994ffc7fb365e11a63c8b655066742dab3be2593c798
SSDEEP

24576:seSqG4yPahfXlKdDxt3rJb8tyxD99PihBT0EKlV6F0xM:LRfXQdDxxeEK7YNyWi

Score

10^/10

remcos remotehost server 2 rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost server 2

149.202.24.70:1960

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-BHNGAP
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 776	1720	PO 001, 002, 003,.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1720	PO 001, 002, 003,.exe
1720	PO 001, 002, 003,.exe
1720	PO 001, 002, 003,.exe
1720	PO 001, 002, 003,.exe
1720	PO 001, 002, 003,.exe
1720	PO 001, 002, 003,.exe
1720	PO 001, 002, 003,.exe
512	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	PO 001, 002, 003,.exe
Token: SeDebugPrivilege	512	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
776	PO 001, 002, 003,.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 512	1720	PO 001, 002, 003,.exe	28
PID 1720 wrote to memory of 512	1720	PO 001, 002, 003,.exe	28
PID 1720 wrote to memory of 512	1720	PO 001, 002, 003,.exe	28
PID 1720 wrote to memory of 512	1720	PO 001, 002, 003,.exe	28
PID 1720 wrote to memory of 588	1720	PO 001, 002, 003,.exe	30
PID 1720 wrote to memory of 588	1720	PO 001, 002, 003,.exe	30
PID 1720 wrote to memory of 588	1720	PO 001, 002, 003,.exe	30
PID 1720 wrote to memory of 588	1720	PO 001, 002, 003,.exe	30
PID 1720 wrote to memory of 1760	1720	PO 001, 002, 003,.exe	32
PID 1720 wrote to memory of 1760	1720	PO 001, 002, 003,.exe	32
PID 1720 wrote to memory of 1760	1720	PO 001, 002, 003,.exe	32
PID 1720 wrote to memory of 1760	1720	PO 001, 002, 003,.exe	32
PID 1720 wrote to memory of 1304	1720	PO 001, 002, 003,.exe	33
PID 1720 wrote to memory of 1304	1720	PO 001, 002, 003,.exe	33
PID 1720 wrote to memory of 1304	1720	PO 001, 002, 003,.exe	33
PID 1720 wrote to memory of 1304	1720	PO 001, 002, 003,.exe	33
PID 1720 wrote to memory of 776	1720	PO 001, 002, 003,.exe	34
PID 1720 wrote to memory of 776	1720	PO 001, 002, 003,.exe	34
PID 1720 wrote to memory of 776	1720	PO 001, 002, 003,.exe	34
PID 1720 wrote to memory of 776	1720	PO 001, 002, 003,.exe	34
PID 1720 wrote to memory of 776	1720	PO 001, 002, 003,.exe	34
PID 1720 wrote to memory of 776	1720	PO 001, 002, 003,.exe	34
PID 1720 wrote to memory of 776	1720	PO 001, 002, 003,.exe	34
PID 1720 wrote to memory of 776	1720	PO 001, 002, 003,.exe	34
PID 1720 wrote to memory of 776	1720	PO 001, 002, 003,.exe	34
PID 1720 wrote to memory of 776	1720	PO 001, 002, 003,.exe	34
PID 1720 wrote to memory of 776	1720	PO 001, 002, 003,.exe	34
PID 1720 wrote to memory of 776	1720	PO 001, 002, 003,.exe	34
PID 1720 wrote to memory of 776	1720	PO 001, 002, 003,.exe	34

C:\Users\Admin\AppData\Local\Temp\PO 001, 002, 003,.exe
"C:\Users\Admin\AppData\Local\Temp\PO 001, 002, 003,.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gkuNeC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:512
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gkuNeC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA1CC.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:588
- C:\Users\Admin\AppData\Local\Temp\PO 001, 002, 003,.exe
  "C:\Users\Admin\AppData\Local\Temp\PO 001, 002, 003,.exe"
  2⤵
  PID:1760
- C:\Users\Admin\AppData\Local\Temp\PO 001, 002, 003,.exe
  "C:\Users\Admin\AppData\Local\Temp\PO 001, 002, 003,.exe"
  2⤵
  PID:1304
- C:\Users\Admin\AppData\Local\Temp\PO 001, 002, 003,.exe
  "C:\Users\Admin\AppData\Local\Temp\PO 001, 002, 003,.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA1CC.tmp

Filesize
1KB

MD5
4ceb26ad93b289fc052ee6516c6bd6dd

SHA1
bbbcbc1cbe6338321a427a28dd42a25c4df950a0

SHA256
c261f1ec134b2ea1a43d599e56d68e76ffcc920002c1cf113cb16811f232ef9b

SHA512
55f94d9368832c9bcdc44144d0e74c7a2213434abfc95c3ac9e423c93607bdf6f8fc5b989e0b226f0a1900b016800aa0ac3bdfcfc6ba8c160f84a005f5f36ce8

Download Submit
memory/512-82-0x000000006EC30000-0x000000006F1DB000-memory.dmp

Filesize
5.7MB

Download
memory/512-81-0x000000006EC30000-0x000000006F1DB000-memory.dmp

Filesize
5.7MB

Download
memory/776-69-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/776-71-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/776-84-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/776-83-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/776-64-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/776-65-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/776-67-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/776-80-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/776-70-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/776-72-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/776-74-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/776-76-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1720-58-0x0000000008240000-0x00000000082F4000-memory.dmp

Filesize
720KB

Download
memory/1720-54-0x0000000000DA0000-0x0000000000EC0000-memory.dmp

Filesize
1.1MB

Download
memory/1720-56-0x00000000002A0000-0x00000000002B4000-memory.dmp

Filesize
80KB

Download
memory/1720-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1720-63-0x0000000008700000-0x000000000877E000-memory.dmp

Filesize
504KB

Download
memory/1720-57-0x00000000003E0000-0x00000000003EA000-memory.dmp

Filesize
40KB

Download